What is an open relay, and how do you check your mail server isn't one?

An open relay is one of the oldest mistakes in running a mail server, and it still happens. One loose setting turns your server into a free sending service for spammers, and within days its IP address can land on blocklists that stop your own mail too. This guide explains what an open relay is, how servers end up as one, how to test yours, and how to close it.

What is an open relay?

An open relay is a mail server that accepts a message from any sender on the internet and delivers it to any other domain, without checking who the sender is or whether they are allowed to use it. Microsoft's Exchange documentation describes it bluntly: "Open relay is a very bad thing for messaging servers on the Internet." It explains that open relays "allow mail from any source to be transparently re-routed," which "masks the original source of the messages, and makes it look like the mail originated from the open relay server."

Relaying itself is normal. A relay is any server that receives a message and passes it on to another server rather than storing it in a local mailbox. Your provider's outgoing server relays your mail to recipients every day. The question is always who the server agrees to relay for. Our guide to the mail transfer agent (MTA) covers the software that does this.

A well-run server relays in only three situations:

1. The recipient is local. The mail is for a domain the server is responsible for, so it's delivery, not relay.
2. The sender has authenticated. A user signed in with a username and password, OAuth or a certificate.
3. The sender is on a trusted network. The connection comes from an IP address the admin has explicitly allowed, such as an office printer.

An open relay skips the last two checks for everyone.

What is the difference between an open relay, anonymous relay and a smart host?

These terms describe who a relay will serve. The difference matters because some of them are legitimate.

Microsoft draws the same line. It calls anonymous relay "a common requirement for many businesses" that have web servers, monitoring tools or devices that "generate email messages, but are incapable of actually sending those messages." Its Microsoft 365 device guidance even says to configure an on-premises server "for anonymous relay (not open relay)" when you need one.

Why is an open relay dangerous?

An open relay is dangerous because it lets strangers send spam and phishing under your server's identity. RFC 2505, the IETF's anti-spam best practice (BCP 30) from 1999, explains why it was the first thing the IETF asked mail admins to fix: "Unauthorized usage of a host as Mail Relay means theft of the relay's resources and puts the relay owner's reputation at risk." Its first requirement for mail software is that it "MUST be able to restrict unauthorized use as Mail Relay."

In practice, an open relay causes four problems:

• Blocklisting. Spam sent through your server comes from your IP address. Public blocklists list that IP, and receivers that use them reject all mail from it, including your real business mail. See what is an email blocklist.
• Damaged sender reputation. Mailbox providers score sending IPs and domains on past behavior. A burst of spam can take weeks to recover from; see what is sender reputation.
• Backscatter and load. Spammers send to huge lists of dead addresses. Your server queues the failures and sends bounces to forged senders, which fills your queue and annoys strangers. Backscatter explains the effect.
• Provider action. Hosting and internet providers act on abuse complaints and may cut off outbound port 25 or suspend the server.

How does a mail server become an open relay?

Few admins set out to build an open relay. It usually happens through one of these settings:

• A trusted network that is too broad. Postfix trusts clients in mynetworks. If that list includes 0.0.0.0/0 or a whole provider range, everyone is "trusted". Postfix's Basic Configuration README warns that mynetworks_style = subnet is "not safe on a wide area network". Since Postfix 3.0 the default style is host, which trusts only the local machine.
• A relay rule written in the wrong place. Before Postfix 2.10, relay rules and spam rules shared smtpd_recipient_restrictions, which Postfix itself calls "error-prone". The SMTPD access README shows how a rule that permits any client announcing itself as localhost.localdomain makes Postfix "an open relay for all such hosts".
• An Exchange connector opened to the world. Exchange's anonymous relay needs a dedicated Receive connector limited to specific IP addresses. Microsoft warns: "Don't attempt to add anonymous relay capability to the default Receive connectors." Adding the Ms-Exch-SMTP-Accept-Any-Recipient permission to a connector that still accepts 0.0.0.0-255.255.255.255 creates an open relay.
• Old relay software and appliances. Legacy relay services, NAS boxes, firewalls and printers with built-in SMTP servers are often set up quickly for a scanner and then forgotten, sometimes with port 25 open to the internet.
• A port forward or firewall change. An internal relay that was safe on the office network becomes an open relay the day a firewall rule exposes it to the internet.

How do I test if my mail server is an open relay?

You test for an open relay by connecting to the server from outside your network and asking it to deliver a message from one outside domain to another. Only test servers you own or are authorized to test.

1. Find the servers to test. Run an MX lookup on your domain, and add any relays, backup MX hosts or devices with port 25 exposed.
2. Connect from outside. Use a machine on a different network, such as a cloud VM or a phone hotspot, because the test from inside your office may be "trusted". Connect to port 25 with telnet or openssl s_client -starttls smtp, as shown in testing an SMTP server with Telnet and OpenSSL.
3. Use outside addresses on both sides. Give a MAIL FROM at a domain you don't host and a RCPT TO at another domain you don't host but control, such as a personal mailbox.
4. Read the reply to RCPT TO. A refusal here means the server won't relay for you.
5. Repeat with variations. Try your own domain as the sender, an empty sender (MAIL FROM:<>), and IPv6 if the server has an IPv6 address. Spammers try them all.
6. Stop before DATA. If the server accepts the recipient, you've found the problem. Send QUIT rather than relaying a real message.

Here is what a correct refusal looks like. It's an example session; host names are placeholders and wording varies by server.

Example session (S = your server, C = test client):

S: 220 mail.yourcompany.example ESMTP
C: EHLO test.outside.example
S: 250-mail.yourcompany.example Hello
S: 250 STARTTLS
C: MAIL FROM:<test@outside.example>
S: 250 2.1.0 Sender OK
C: RCPT TO:<you@another-outside.example>
S: 550 5.7.1 Unable to relay
C: QUIT
S: 221 2.0.0 Service closing transmission channel

That 550 5.7.1 Unable to relay is the reply Microsoft documents for an Exchange connector that refuses anonymous relay. RFC 5321, section 3.6.2 says that a server that "declines to relay mail to a particular address for policy reasons" should return a 550. Postfix's default relay rule, defer_unauth_destination, refuses the same requests "with a non-permanent error code" (4xx) instead, which is also safe. If you use reject_unauth_destination, Postfix refuses permanently with the code in relay_domains_reject_code, which defaults to 554. Look up any reply in the SMTP error code lookup or on our 550 5.7.1 page.

If the server answers 250 to that outside recipient, it is an open relay. Close it before you do anything else.

How do I close an open relay?

You close an open relay by allowing relay only for authenticated users and named internal addresses, and refusing everything else.

Postfix

Postfix 2.10 and later separate relay control into smtpd_relay_restrictions. Its documented default is safe:

smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination
mynetworks = 127.0.0.0/8 [::1]/128 192.168.10.0/24

Set mynetworks to your real internal ranges only (the 192.168.10.0/24 above is an example), and make sure the relay rule ends in defer_unauth_destination or reject_unauth_destination. Run postconf smtpd_relay_restrictions mynetworks to see what your server actually uses, then postfix reload.

Exchange Server

Follow Microsoft's anonymous relay guidance: create a dedicated Receive connector in the Front End Transport service and limit it to the IPs that need it.

New-ReceiveConnector -Name "Anonymous Relay" -TransportRole FrontendTransport -Custom -Bindings 0.0.0.0:25 -RemoteIpRanges 192.168.5.10,192.168.5.11

Then check what each connector allows with Get-ReceiveConnector | Format-List Name,RemoteIPRanges,PermissionGroups. Any connector that combines anonymous permissions with a remote range of 0.0.0.0-255.255.255.255 needs fixing. Microsoft advises that you "err on the side of being too specific instead of too general."

Microsoft 365 and Google Workspace

Cloud platforms don't relay for strangers, but their relay features can still be configured too loosely. Microsoft 365's SMTP relay connector authenticates devices by certificate or a static public IP address "that isn't shared with another organization", according to Microsoft Learn. Google Workspace's SMTP relay service asks you to choose allowed senders and to require IP address or SMTP authentication; our Google Workspace SMTP relay guide walks through each setting. In both, keep IP ranges as small as possible. Direct Send is a separate Microsoft 365 risk; see Direct Send spoofing.

What if spammers are relaying through a real account?

An authenticated server isn't an open relay, but it can be abused the same way if a password is stolen. The spam looks identical in your logs except that it comes from one signed-in user. Signs include a sudden queue of outbound mail, bounces for messages nobody sent, or Microsoft 365 blocking a user from sending. Reset the password, revoke sessions and require multifactor authentication, then work through signs an email account is compromised. RFC 6409, the submission standard, is why port 587 requires authentication by default: a submission server that skips it "is allowing open use of its resources and name."

How do I recover if my server was an open relay?

Use this order so the problem doesn't come straight back:

1. Close the relay using the steps above, and retest from outside.
2. Clear the queue. Delete the spam that is still waiting to be sent, or it will keep going out and keep bouncing.
3. Check your IP with the Blacklist Checker and confirm your reverse DNS (PTR) record still looks like a mail server.
4. Request delisting only after the cause is fixed. Removing a domain or IP from a blacklist covers each list's process.
5. Watch your logs for a week for new relay attempts and for outbound volume you can't explain.

Next steps

• Test every server that listens on port 25 from outside your network, including backup MX hosts and devices.
• Review relay settings after every firewall, connector or software change.
• Move printers and apps to authenticated submission or a tightly scoped relay. iBlockSpam includes an outbound relay with DKIM signing, 500 messages per domain per month included, as one option.
• Check that your sending IP is clean with the free Blacklist Checker.

Browse our other email basics guides.